Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,865 detections
Filters
Last updated
All Time
Detection languages
2,524
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,091
792
575
Platforms
39,932
7,263
6,535
3,865
3,643
Products / Services
1,755
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
KQL Query
Detects when a single user account successfully signs in from two or more distinct IP addresses within a short timeframe. This can be an indicator of an adversary-in-the-middle (AiTM) attack where both the legitimate user and the attacker have active, authenticated sessions from different locations.
Azure Blob Anonymous Access
Cortex XDR
Detects unauthenticated or anonymous access attempts to Azure Blob Storage. This rule identifies successful operations where the identity is explicitly listed as 'anonymous', indicating potential misconfigurations or unauthorized access to sensitive data.
This query identifies potential post-exploitation behavior on Linux systems by monitoring for clusters of discovery and enumeration commands. Instead of alerting on single, potentially benign commands, it utilizes a behavioral scoring engine that categorizes activities such as credential hunting, privilege escalation, and network scanning.
By implementing extensive allowlists for common administrative tools (e.g., Ansible, Zabbix, Monitoring Agents) and requiring a minimum threshold of unique activity categories, the query effectively filters out "noise." It calculates a dynamic Risk Score and assigns a Severity level based on the criticality of the commands and the speed of execution (Burst Detection), making it a highly reliable tool for SOC analysts to detect active hands-on-keyboard attacks.
By implementing extensive allowlists for common administrative tools (e.g., Ansible, Zabbix, Monitoring Agents) and requiring a minimum threshold of unique activity categories, the query effectively filters out "noise." It calculates a dynamic Risk Score and assigns a Severity level based on the criticality of the commands and the speed of execution (Burst Detection), making it a highly reliable tool for SOC analysts to detect active hands-on-keyboard attacks.
This rule detects potential brute force or credential stuffing attacks against Azure AD by identifying multiple failed sign-in attempts followed by a successful sign-in from the same user and IP address within a short time frame (1 minute). It specifically looks for scenarios where the successful sign-in occurs after the failed attempts and involves different applications, excluding common Office 365 services to reduce noise.
Detects successful Entra ID sign-ins that exhibit characteristics of an Adversary-in-the-Middle (AiTM) session cookie hijack.
This activity is often associated with AiTM phishing kits like Tycoon2FA, where attackers replay stolen session cookies from unmanaged devices to bypass MFA.
This activity is often associated with AiTM phishing kits like Tycoon2FA, where attackers replay stolen session cookies from unmanaged devices to bypass MFA.
This rule detects network connections and user sign-ins originating from IP addresses identified as belonging to Iran. It also identifies sign-ins where the reported country is Iran, but the IP address is not found within the provided Iranian IP list, which could indicate IP geolocation discrepancies or obfuscation attempts.
This detection identifies when a user clicks a URL in an email and shortly after, a risky sign-in is detected for the same user account. This pattern is indicative of a successful phishing attack, where a user is lured to a malicious site, enters their credentials, and the attacker uses those credentials or the session token to log in from a different location.
Azure Impossible Travel Detection
Cortex XDR
Detects an identity signing in from two or more distinct geolocations within a one-hour window in Azure, indicating potential impossible travel activity.
This rule detects the installation of suspicious extensions on Azure Virtual Machines. These extensions, such as CustomScriptExtension, RunCommandHandler, DSCExtension, AADLoginForWindows, and NetworkWatcherAgent, can be abused by attackers for various purposes including remote code execution, configuration manipulation, unauthorized account access, or network reconnaissance. Monitoring their installation can help identify potential compromise or malicious activity within an Azure environment.
This query identifies users exhibiting unusual authentication behavior by combining Behavior Analytics with recent sign-in activity. It highlights high‑risk sign-ins originating from previously unseen IP addresses where the user agent or operating system has changed compared to historical patterns. The query enriches findings with historical sign-in context and Identity Info to support investigation of potentially compromised accounts.
Large Azure Blob Downloads
Cortex XDR
Detects an identity downloading an unusually high number of blobs (more than 100) from Azure Storage within a one-hour window. This could indicate data exfiltration or unauthorized bulk access to cloud storage.
This rule detects unusual access patterns to Azure resources where a single identity (user or service principal) accesses resources from multiple distinct IP addresses and/or geographic locations within a 7-day timeframe. This behavior can indicate compromised credentials, session hijacking, or an adversary attempting to evade detection by frequently changing their apparent origin.
Detects a single Azure identity accessing three or more distinct Azure resource types within a short time window. This behavior can indicate an attacker attempting to enumerate or pivot through an environment after compromising an identity.
The below Sentinel KQL analytics rule is able to detect potential privilege escalation to Global Admin role via compromised service principal
Detects suspicious sign-in activities by user in a specified timeframe
This is highly adjustable script that tells us whether HTTPS request was successful, the reason why it was blocked or not, and on top of that, it explains the error code. This is still a work-in-progress but it already does 99% of the job.
Detects URL click events or browser launches where the URL targets Microsoft or Google OAuth endpoints and contains the combination of 'prompt=none' and 'scope=invalid'. This specific combination is used by attackers to force a silent error redirect to a malicious URI.
This detection identifies the consent or addition of an OAuth application that may be impersonating a legitimate, well-known brand. The logic flags applications whose names mimic major brands (e.g., Adobe, Microsoft, DocuSign) and use a reply URL hosted on a shared or free platform, a common tactic in consent phishing campaigns.
Identifies consent grants to OAuth applications with Application IDs matching known malicious campaigns. The IOCs are sourced from Wiz Research on campaigns from 2019-2025 involving brand impersonation and consent phishing.
Detects configuration changes on firewall devices via CommonSecurityLog.
Specifically looks for CONFIG activity that is not an audit-commit,
indicating an actual configuration change was made rather than a
read-only audit operation.
Note: Field aliasing (Client, Administrator, Host_IP, Command, Result,
Configuration_Path, Before_Change, After_Change) via extend,
fixed date window via datetime_local_to_utc, and project-reorder
are handled natively in KQL post-conversion. See third item of the
reference. Original query was scoped to a fixed date window, which is
(2026-02-09 to 2026-02-10 PST) suggesting threat hunting intent.
However, it's worthnoting that Sigma version uses a rolling 24h window
for continuous detection. This is the detection version of my KQL script.
Specifically looks for CONFIG activity that is not an audit-commit,
indicating an actual configuration change was made rather than a
read-only audit operation.
Note: Field aliasing (Client, Administrator, Host_IP, Command, Result,
Configuration_Path, Before_Change, After_Change) via extend,
fixed date window via datetime_local_to_utc, and project-reorder
are handled natively in KQL post-conversion. See third item of the
reference. Original query was scoped to a fixed date window, which is
(2026-02-09 to 2026-02-10 PST) suggesting threat hunting intent.
However, it's worthnoting that Sigma version uses a rolling 24h window
for continuous detection. This is the detection version of my KQL script.
Page 140 of 185